TRENDING

CyberEye

Can the two-man rule foil insider threats?

In the wake of embarrassing leaks by Edward Snowden about the National Security Agency’s domestic and international intelligence gathering, the agency is trying to figure out how it lost control of this information and how to prevent it from happening again.

As to how it happened, NSA Director Gen. Keith Alexander has a pretty good idea, at least at a high level: Too many people with access.

Alexander told the House Select Permanent Intelligence Committee on June 18 that NSA now has at least 1,000 systems administrators, a growing number of them contractors, like Snowden. Administrators are defined by their privileges on IT systems, their ability to access, define and change just about anything they want. One thousand is a lot of administrators to keep track of. Many people, Alexander included, think it is too many by at least one.

“Clearly the system did not work as it should have,” the general said in a June 23 appearance on ABC News’ This Week. “He betrayed the trust and confidence we had in him.”

The problem of administrative creep is not a new one, nor is it unique to the NSA or government.

“It’s a common audit finding that organizations have too many administrative personnel,” said Dave Frymier, chief information security officer at Unisys. Unisys faced the same problem when it found one day it had more than 100 Microsoft administrators. That number eventually was reduced to fewer than 15. “It just shows that they’re human,” he said of the NSA.

Alexander offered some ideas on how NSA plans to deal with the problem of trust. “We are now putting in place actions that would give us the ability to track our system administrators, what they're doing, what they're taking. A two-man rule,” he told ABC’s George Stephanopoulos.

The “two-man” rule requires two people with separate sets of credentials for access to sensitive resources. It can be expensive in terms of manpower and is not fool-proof, but most in the security community think it is a good idea, especially in an environment as sensitive as the NSA.

“I fall into the category of people who wonder why they hadn’t been doing this all along,” Frymier said. “It’s expensive, but it’s one of the better solutions to the problem.”

It is not the only solution, of course. The first — and most obvious — fix is to minimize the number of systems administrators. As with many simple solutions, however, this is easier said than done. While having a lot of administrators can be a security risk, it also helps to lighten workloads and make it easier to keep systems up and running. People tend to care about security risks only after an incident, but they care about having their systems running seven days a week, so convenience often trumps security.

A second solution is to reduce the privileges given to each administrator. Not all of them need all of the privileges all of the time. A system to grant privileges as required and to revoke them when a task is completed can make it easier to manage the managers. Microsoft has a more fine-grained administrative environment than Unix, and there are off-the-shelf tools to help with this process in a Microsoft environment. Unfortunately, NSA appears to be largely a Unix shop, Frymier said. But with its resources, the agency probably could develop its own administrative tools.

Another good security practice is to log all administrator activity. The problem with this is that logs often are looked at only after an incident, and administrators often have the ability to alter logs. This is where a system for real-time monitoring and alerting for suspicious activity would come in handy.

There are any number of other steps for segregating and protecting sensitive data, but none of them fool-proof. Eventually you have to trust someone with sensitive information. “At some point the problem is a human resource problem rather than a technical one,” Frymier said.

So the Cold War saw of “trust but verify” makes sense. “The two-man rule really is the best solution to the problem,” Frymier said. “It’s a good way to get a vast improvement.”

inside gcn

Reader Comments

Tue, Jul 30, 2013

Secure Access Technologies launched a 'Two-Man Rule' solution that implements on any existing system in minutes. No coding or integration. 7 factors of authentication:www.SecureAccessTechnologies.com

Tue, Jul 9, 2013
Dave
NorCal

The Two-Man Rule and "no alone zone" systems worked during the Cold War to ensure that no single individual had unrestricted access to (and therefore control over), or would be alone in proximity to, nuclear weapon(s) and/or systems linked to them, including electro-mechanical and electronic controls (like computers) and delivery systems. This was a well-thought out and implemented policy -- Dr. Strangelove never would happen. Additionally, the Human Reliability program (and HUMRRO) provided on-going vetting of the psychological fitness of military and civilian individuals alike who worked directly with or had access to nuclear material, nuclear power plants and devices (weapons) and delivery systems. It has worked so far; the alternative to its not working would be a Tom Clancy plot. The two-person rule and "no alone zone" plus human reliability practices might as well work with Cybersec, which BTW could directly and indirectly communicate with nuclear-related or controlling systems -- remember "War Games", the movie? Also, definitely for most if not all applications, admin logs must be made to be "chiseled in stone" (non-erasable); otherwise, where's the accountability?

Wed, Jul 3, 2013
abqjfc

A solution would to be a separate group (cyber folks) being notified of Admin activity, and only Cyber having access to logging info. Admin access MUST be logged and logs must be reviewed by others... I.e. separation of duties!

Wed, Jul 3, 2013
Duey

Their covert snooping into the citizens who provide the funds for their paychecks should be known. Their security on this information is counter-productive at the least.

Please post your comments here. Comments are moderated, so they may not appear immediately
after submitting. We will not post comments that we consider abusive or off-topic.